The EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. Data Privacy Framework (UK Extension to the EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) were respectively developed in furtherance of transatlantic commerce by the U.S. Department of Commerce and the European Commission, the UK Government, and the Swiss Federal Administration to provide U.S. organizations with reliable mechanisms for personal data transfers to the United States from the European Union / European Economic Area, the United Kingdom (and Gibraltar), and Switzerland while ensuring data protection that is consistent with EU, UK, and Swiss law.
The Data Privacy Framework (DPF) Program, which is administered by the International Trade Administration (ITA) within the U.S. Department of Commerce, enables eligible U.S.-based organizations to self-certify their compliance pursuant to the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF. To participate in the DPF Program, a U.S.-based organization is required to self-certify to the ITA via the Department's DPF Program website (https://www.dataprivacyframework.gov) and publicly commit to comply with the DPF Principles. To rely on the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF for transfers of personal data from the European Union and, as applicable, the United Kingdom (and Gibraltar), and/or Switzerland an organization must not only self-certify its adherence to the DPF Principles to the ITA, but also both be placed and remain on the Data Privacy Framework List. The ITA will update the Data Privacy Framework List on the basis of annual re-certification submissions made by participating organizations and by removing organizations when they voluntarily withdraw, fail to complete the annual re-certification in accordance with the ITA's procedures, or are found to persistently fail to comply.
While the decision by an eligible U.S.-based organization to self-certify its compliance pursuant to and participate in the relevant part(s) of the DPF Program is voluntary, effective compliance upon self-certification is compulsory. Once such an organization self-certifies to the ITA and publicly declares its commitment to adhere to the DPF Principles that commitment is enforceable under U.S. law.
All organizations interested in self-certifying their compliance pursuant to the EU-U.S. DPF and, as applicable, the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF should review the requirements in their entirety. To assist in that effort, the ITA’s DPF team has compiled relevant resources, including those describing the scope of the DPF Program, relevant implementation dates, and answers to frequently asked questions and made these resources available on the DPF Program website.
The ICDR-AAA provides several dispute resolution and administrative services related to the DPF Program.
Independent Recourse Mechanism (IRM)
The EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF require participating organizations to provide, at no cost to the individual, an Independent Recourse Mechanism (IRM) by which each individual’s complaints and disputes can be investigated and expeditiously resolved. The ICDR-AAA provides an Independent Recourse Mechanism required for participating organizations.
Annex I Binding Arbitration Mechanism
As described on the ICDR-AAA services pages for Annex I of the EU-U.S. DPF Principles, and Annex I of the Swiss-U.S. DPF Principles , an EU / EEA, UK, or Swiss individual has the option to invoke binding arbitration to determine whether a participating organization has violated its obligations under the DPF Principles as to that individual and whether any such violation remains fully or partially unremedied (“residual claims”).
In Annex I of the DPF Principles, the U.S. Department of Commerce committed to the maintenance of a fund to which participating organizations will be required to contribute to cover the arbitral costs, including arbitrator fees, up to maximum amounts. The International Centre for Dispute Resolution-American Arbitration Association (ICDR-AAA) was selected by the U.S. Department of Commerce to administer arbitrations pursuant to and manage the arbitral fund identified in Annex I of the DPF Principles.